CVE-2026-20526: CWE-787 Out-of-bounds Write in MediaTek, Inc. MediaTek chipset

This vulnerability (CVE-2026-20526) involves an out-of-bounds write (CWE-787) in the modem of MediaTek chipsets due to a missing bounds check. An attacker controlling a rogue base station can exploit this flaw when a user device connects to it, potentially escalating privileges remotely. Exploitation requires user interaction but no additional execution privileges are needed. The issue is tracked under MediaTek's internal ID MSV-8906 and patch ID MOLY01898195. Affected chipset models include MT2716, MT2735, MT2737, MT6813, MT6815, MT6833, MT6835, MT6853, MT6855, MT6858, MT6873, MT6875, MT6877, MT6878, MT6879, MT6880, MT6881, MT6883, MT6885, MT6886, MT6889, MT6890, MT6891, MT6893, MT6895, MT6896, MT6897, MT6899, MT6980, MT6982, MT6983, MT6985, MT6986, MT6988, MT6989, MT6990, MT6991, MT6993, MT8668, MT8676, MT8678, MT8755, MT8771, MT8775, MT8791, MT8792, MT8793, MT8796, MT8797, MT8798, MT8863, MT8873, MT8883, and MT8893. No patch or remediation details are provided in the source data.

The vulnerability allows remote escalation of privilege on affected MediaTek chipsets when a user device connects to a malicious rogue base station. This could compromise the security of the device's modem subsystem. Exploitation requires user interaction but no additional execution privileges, increasing the risk in scenarios involving rogue network infrastructure. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor has assigned a patch ID (MOLY01898195), indicating a fix may exist or is in development. Until official patches are confirmed and applied, users should avoid connecting to untrusted or suspicious base stations. Monitor MediaTek's official advisories for updates and apply patches promptly once available.